Plugging in CA certificate and key

This task shows how operators can plug existing certificate and key into Istio CA.

By default, the Istio CA generates self-signed CA certificate and key and uses them to sign the workload certificates. The Istio CA can also use the operator-specified certificate and key to sign workload certificates. This task demonstrates an example to plug certificate and key into the Istio CA.

Before you begin

Plugging in the existing certificate and key

Suppose we want to have Istio CA use the existing certificate ca-cert.pem and key ca-key.pem. Furthermore, the certificate ca-cert.pem is signed by the root certificate root-cert.pem, and we would like to use root-cert.pem as the root certificate for Istio workloads.

In this example, because the Istio CA certificate (ca-cert.pem) is not set as the workloads’ root certificate (root-cert.pem), the workload cannot validate the workload certificates directly from the root certificate. The workload needs a cert-chain.pem file to specify the chain of trust, which should include the certificates of all the intermediate CAs between the workloads and the root CA. In this example, it only contains the Istio CA certificate, so cert-chain.pem is the same as ca-cert.pem. Note that if your ca-cert.pem is the same as root-cert.pem, you can have an empty cert-chain.pem file.

Redeploy the Istio CA, which reads the certificates and key from the secret-mount files:

kubectl apply -f install/kubernetes/istio-ca-plugin-certs.yaml

To make sure the workloads obtain the new certificates promptly, delete the secrets generated by Istio CA (named as istio.*). In this example, istio.default. The Istio CA will issue new certificates for the workloads.

kubectl delete secret istio.default

Note that if you are using different certificate/key file or secret names, you need to change corresponding arguments in istio-ca-plugin-certs.yaml.

Verifying the new certificates

In this section, we verify that the new workload certificates and root certificates are propagated. This requires you have openssl installed on your machine.